Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Tomcat Version Check on ICM Servers

Frequent Asked Questions

Introduction

This document describes the impact of Apache Log4j vulnerability on Cisco Contact Center (UCCE) product line.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

- Cisco Unified Contact Center product version 11.6 and higher.

Background Information

Apache recently announced a vulnerability in Log4j component. It is widely used in Cisco Contact Center solution and Cisco is actively in the evaluation of the product lineup to verify what is safe and what is affected.

Note:  More information is available here: Cisco Security Advisory - cisco-sa-apache-log4j

This document presents more information as it becomes available .

Application

Defect Id

11.6.(2)

12.0(1)

12.5(1)

12.6(1)

UCCE/ICM

CSCwa47273

Patch - 11.6(2)_ES84

ReadMe

Patch - 12.0(1)_ES91

ReadMe

Patch - 12.5(1)_ES101

ReadMe

Note 1: ES_55 patch Required, refer OpenJDK Migration doc

Note 2: Tomcat Version Check- Refer section "Tomcat Version Check on ICM Servers" below

Patch - 12.6(1)_ES17

ReadMe

PCCE

CSCwa47274

Patch - 11.6(2)_ES84

ReadMe

Patch - 12.0(1)_ES91

ReadMe

Patch - 12.5(1)_ES101

ReadMe

Note 1: ES_55 patch Required, refer OpenJDK Migration doc

Note 2: Tomcat Version Check- Refer section "Tomcat Version Check on ICM Servers" below

Patch - 12.6(1)_ES17

ReadMe

CTIOS

Not impacted

Not impacted

Not impacted

Not impacted

Application

Defect Id

11.6(1)

12.0(1)

12.5(1)

12.6(1)

CVP

CSCwa47275

Patch - 11.6(1) ES16

Readme

Patch - 12.0(1)_ES10

ReadMe

Patch - 12.5(1)_ES25

ReadMe

Patch - 12.6(1)_ES9

ReadMe

VVB

CSCwa47397

Not impacted

Not impacted

Patch - 12.5(1)_ES12

Readme

Patch - 12.6(1)_ES03

ReadMe

* use patch published on 29th Dec 2021

Call Studio

CSCwa54008

Callstudio_11.6_Log4j_fix

ReadMe

Callstudio_12.0(1)_Log4j_fix

ReadMe

Callstudio_12.5(1)_Log4j_fix

ReadMe

Callstudio_12.6(1)_Log4j_fix

ReadMe

Finesse

CSCwa46459

Not impacted

Not impacted

Not impacted

Patch - 12.6(1)_ES3

ReadMe

CUIC

CSCwa46525

Not impacted

Not impacted

Not impacted

Patch - 12.6(1)_ES03

ReadMe

Live Data (LD)

CSCwa46810

Patch - 11.6.1_COP23

ReadMe

Patch - 12.0(1)_ES18

ReadMe

Patch - 12.5(1)_ES13

ReadMe

Patch - 12.6(1)_ES03

ReadMe

IDS

Not impacted

Not impacted

Not impacted

Not impacted

CUIC Co-res (CUIC-LD-IDS)

CSCwa46810

Patch - 11.6.1_COP23

ReadMe

Patch - 12.0(1)_ES18

ReadMe

Patch - 12.5(1)_ES13

ReadMe

Patch - 12.6(1)_ES03

ReadMe

CloudConnect

CSCwa51545

Not impacted

Patch - 12.6(1)_CC_COP

ECE

CSCwa47392

Not impacted

Patch - 12.0(1)_ES6_ET2

ReadMe

Patch - 12.5(1)_ES3_ET2

ReadMe

Patch - 12.6(1)_ET2

ReadMe

CCMP

CSCwa47383

Not impacted

Not impacted

Patch - 12.5(1)_ES6

ReadMe

Patch-12.6(1)_ES3

ReadMe

CCDM

CSCwa47383

Not impacted

Not impacted

Patch - 12.5(1)_ES6

ReadMe

Patch - 12.6(1)_ES3

ReadMe

Google CCAI

Google confirmed CCAI feature set is Not impacted

Webex Experience Management (WxM)

WxM does not user log4j hence solution is Not impacted

Customer Collaboration Platform (CCP)

CSCwa47384

Not impacted

Not impacted

Not impacted

Not impacted

* Dates of release are subject to change and will be updated as needed until patch is released

Tomcat Version Check on ICM Servers

1. On ICM servers i.e. Routers, Loggers, PG and AW servers check the version of tomcat installed by running "<ICM HOME>\tomcat\bin\version.bat" file.

2. If the tomcat version is 9.0.37 or higher, perform these steps to fix the defect "CSCvv73307"

3. Install ES_81 patch on the server. If there are any ES's greater than 81 on the ICM server do ensure first to uninstall those ES's

- 12.5(1)_ES81 Patch - https://software.cisco.com/download/specialrelease/0aab225ecde522734cc6c6491ad1eb42

- 12.5(1)_ES81 ReadMe - https://www.cisco.com/web/software/280840583/158250/Release_Document_1.html

4. After successful install of ES_81 confirm the tomcat version again by running the bat file "<ICM HOME>\tomcat\bin\version.bat"

5. Tomcat version should remain the same as step 1, If same proceed with orderly reinstall of all the desired ES's upto and including log4j patch i.e. ES_101

Frequent Asked Questions

Q.1  How often is the document revised with latest information?

Answer:  The document is reviewed daily and updated in the morning (US hours)

Q.2  Are the ICM versions i.e. (Router ,Logger, AW, PG) 10.x , 11.0(x) , 11.5(x) and 11.6(1) affected?

Answer: These versions are not impacted as they use 1.X version of log4j.

Note: The advisory table lists specific bugs for the versions which are under maintenance. Versions which are not highlighted are end of software maintenance and are not considered for review.

Q.3 When are patches released?

Answer: The advisory table highlights tentative dates when the patches are released. The table will be updated with the related links as they become available.

Q.4 Any workaround which can be implemented until the fix is ready ?

Answer: Recommendation is to follow the PSIRT advisory and ensure that patches are applied as soon as possible once released for affected versions.

Q.5 CUIC Standalone 11.6(1) is not affected y log4j, However the readme of ES states its a required patch on the server - why ?

Answer: This ES is not a standalone ES having only log4j fix, this ES23 is a cumulative ES like we would have for any VOS product. i.e There is only one latest and cumulative ES available to the Customer at any point of time. Consider this scenario, wherein Cu is in Standalone CUIC 11.6 ES 21 (or before ) and are requiring the CUIC defect fixes of ES22, in that case they still need to install ES23 (as ES are cumulative and only latest version of ES are available for the customer) . Moreover this log4j defect is mentioned and listed under LD defect in the ES Readme. During ES installation, defect fixes are installed based on the deployment as applicable ( i.e deployment check is made whether - Standalone CUIC /co-res CUIC/LD prior to ES installation and defect fixes are applied accordingly)

Q.6 What actions do I take if my organizations security scanner (Example: Qualys) picks up CVE-2021-45105 after I patched my UCCE Product?

Answer: No action is needed as Cisco has reviewed CVE-2021-45105 and has determined that no Cisco products or cloud offerings are impacted by this vulnerability. This information has been highlighted in the advisory as well. For Log4j version 2.16.0 to be DDoS vulnerable a non-default configuration is required for exploitability. This means that the attacker should manually modify the log4j configuration file and this is not possible in UCCE Products, hence CVE-2021-45105 is not applicable.

Q7. What do I do when I see older Log4j ".jar" files on my system such as 1.2x files?

Answer: Recommendation is to leave the old files so that the rollback process would not be broken. Having an inactive version of these files on the system does not leave the component vulnerable.

However, if business requires the files need to be removed it strongly encouraged to test the desired process in lab prior to implement the steps in production to minimize impact. It is also recommended to have backup and rollback plan handy to recover the system in case there are issues with the activity.